Go + gRPC - Gateway (V2) build a micro service actual combat series, small application login authentication service (3) : RSA signature (RS512) JWT (demo)

A series of

Cloud native API Gateway, GRPC-Gateway V2 Exploration
Go + GRPC-gateway (V2) Construction of micro-service combat series, small program login authentication service: the first chapter
Go + GRPC-Gateway (V2) Construction of micro-service combat series, small program login authentication service: the second chapter

JWT & RS512

JWT and RSA are not popular here. Google it, too many articles.

IO/jwt. IO /

Here we look at the picture to speak, note the Decoded part:

HEADER:ALGORITHM & TOKEN TYPE
PAYLOAD:DATA
VERIFY SIGNATURE

Yes, JWT consists of these three parts: header.payload-signature. We choose asymmetric encryption algorithm (RS512).

In simple terms (when encoding), the authentication microservice uses the Private Key to generate the signature, and other microservices use the Public Key to verify that the signature is issued by the Auth microservice (expired, whether the data is tampered with, etc.). Private Key and Public Key come in pairs.

The code test is directly provided by jwt. IO, so let’s just copy it.

RSA PRIVATE KEY

We put it in microsvcs/auth/private key

PUBLIC KEY

We put it in microsvcs/auth/public key

Payload

Here we will use the following test Data:

{
  "exp": 1516246222."iat": 1516239022."iss": "server/auth"."sub": "607266aa512e006d58b79d22"
}
Copy the code

iss: indicates who issued the certificate. Here is our authentication micro service.
iat:tokenThe issuance of time
exp:tokenExpiration time
sub: Who is issued, here is our account numberID

Coding of actual combat

Define the TokenGenerator interface & use

We entered the microsvcs/auth/auth/auth. Go, the continuation of our previous logic, because the generated Token is a separate implementation, so generally we define a TokenGenerator interface.

type TokenGenerator interface {
	GenerateToken(accountID string, expire time.Duration) (string, error)
}
Copy the code

User-defined interface! User-defined interface! User-defined interface! Important things say three times!!

Struct type Service struct:

type Service struct {
	Mongo          *dao.Mongo
	Logger         *zap.Logger
	OpenIDResolver OpenIDResolver
	TokenGenerator TokenGenerator / / generator
	TokenExpire    time.Duration  // Expiration time
	authpb.UnimplementedAuthServiceServer
}
Copy the code

We have TokenGenerator & TokenExpire passed in from the outside, all configurable to replace the implementation at any time.

It’s very simple to use:

. . tkn, err := s.TokenGenerator.GenerateToken(accountID, s.TokenExpire)iferr ! =nil {
	s.Logger.Error("cannot generate token", zap.Error(err))
	return nil, status.Error(codes.Internal, "")}return &authpb.LoginResponse{
	AccessToken: tkn,
	ExpiresIn:   int32(s.TokenExpire.Seconds()),
}, nil
Copy the code

Implement the TokenGenerator interface

We write the following code (file located in microsvcs/auth token/JWT. Go) :

type JWTTokenGen struct {
	privateKey *rsa.PrivateKey
	issuer     string
	nowFunc    func(a) time.Time
}
func NewJWTTokenGen(issuer string, privateKey *rsa.PrivateKey) *JWTTokenGen {
	return &JWTTokenGen{
		issuer:     issuer,
		nowFunc:    time.Now,
		privateKey: privateKey,
	}
}
func (t *JWTTokenGen) GenerateToken(accountID string, expire time.Duration) (string, error) {
	nowSec := t.nowFunc().Unix()
	token := jwt.NewWithClaims(jwt.SigningMethodRS512, jwt.StandardClaims{
		Issuer:    t.issuer, / / issue
		IssuedAt:  nowSec, // Issue time
		ExpiresAt: nowSec + int64(expire.Seconds()), // Expiration time
		Subject:   accountID, // To whom
	})
	return token.SignedString(t.privateKey)
}
Copy the code

The code is always the same:

To define astruct(JWTTokenGen)
This can be initialized externallystruct(NewJWTTokenGen), make some public and private resources configurable (e.g.rsa.PrivateKey)
TokenGeneratorConcrete implementation of the interface (GenerateToken)

Note: nowFunc is defined so that Unit Tests can fix a point in time to do the issuing work.

Write the test

The code is located in Microsvcs/Auth /token/jwt_test.go:

func TestGenerateToken(t *testing.T) {
	pkFile, err := os.Open(".. /private.key")
	iferr ! =nil {
		logger.Fatal("cannot open private key", zap.Error(err))
	}
	pkBytes, err := ioutil.ReadAll(pkFile)
	iferr ! =nil {
		logger.Fatal("cannot read private key", zap.Error(err))
	}
	key, err := jwt.ParseRSAPrivateKeyFromPEM(pkBytes)
	iferr ! =nil {
		logger.Fatal("cannot parse private key", zap.Error(err))
	}
	g := NewJWTTokenGen("server/auth", key)
	g.nowFunc = func(a) time.Time {
		return time.Unix(1516239022.0)
	}
	tkn, err := g.GenerateToken("607266aa512e006d58b79d22".2*time.Hour)
	iferr ! =nil {
		t.Errorf("cannot generate token: %v", err)
	}

	want := "eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1MTYyNDYyMjIsImlhdCI6MTUxNjIzOTAyMiwiaXNzIjoic2VydmVyL2F1dGgiLCJzdWIiOi I2MDcyNjZhYTUxMmUwMDZkNThiNzlkMjIifQ.nwhaGZ0dozftexVfr9KM9ZVAzsPudhLs-n-yyrrjkbFTYA69rsEd35M0vc1gJ1DNMJk_v-1yUhkgRpxzP2J iy1Lw8fqIlAk8l9EpDE77oJ9Dal6Rl26GERYZOkCvbq02fKSVj4drlSr75fIce9EnQq2xIVyvvNNty-QvHXTX29QQv-6c8vVYIrCFxtooARN9p8OSpg0hzc- YzsXo64lbUvbLIws27TJNwhctbqrOYQuX9XU3UhJ4Ik0Yt2cLc4LjuqI52Grvf89mJMmM5jnHQv0tKI2guvxNwlC3WN50dCIcuo1zjO-_eSje5OvqP7FKR1e SwnEcZiZQ8qwDDGi8pA"

	iftkn ! = want { t.Errorf("wrong token generated. want: %q, got: %q", want, tkn)
	}
}
Copy the code

alignment

Update microsvcs/auth/main. Go

We add TokenExpire and TokenGenerator configurations.

authpb.RegisterAuthServiceServer(s, &auth.Service{
    OpenIDResolver: &wechat.Service{
    	AppID:     "your-app-id",
    	AppSecret: "your-app-secret",
    },
    Mongo:          dao.NewMongo(mongoClient.Database("grpc-gateway-auth")),
    Logger:         logger,
    TokenExpire:    2 * time.Hour,
    TokenGenerator: token.NewJWTTokenGen("server/auth", privKey),
})
Copy the code

Small program tuning

Perfect issuance of tokens.

Keep watching, to be continued…

Refs

API Security : API key is dead.. Long live Distributed Token by value
Demo: go-grpc-gateway-v2-microservice
gRPC-Gateway
gRPC-Gateway Docs

I am weishao wechat: uuhells123 public number: hackers afternoon tea add my wechat (mutual learning exchange), pay attention to the public number (for more learning materials ~)Copy the code

mo4tech.com (Moment For Technology) is a global community with thousands techies from across the global hang out!Passionate technologists, be it gadget freaks, tech enthusiasts, coders, technopreneurs, or CIOs, you would find them all here.

Go + gRPC – Gateway (V2) build a micro service actual combat series, small application login authentication service (3) : RSA signature (RS512) JWT (demo) | Go on topic

A series of

JWT & RS512

RSA PRIVATE KEY

PUBLIC KEY

Payload

Coding of actual combat

Define the TokenGenerator interface & use

Implement the TokenGenerator interface

Write the test

alignment

Update microsvcs/auth/main. Go

Small program tuning

Refs

Go + gRPC – Gateway (V2) build a micro service actual combat series, small application login authentication service (3) : RSA signature (RS512) JWT (demo) | Go on topic

A series of

JWT & RS512

RSA PRIVATE KEY

PUBLIC KEY

Payload

Coding of actual combat

Define the TokenGenerator interface & use

Implement the TokenGenerator interface

Write the test

alignment

Update microsvcs/auth/main. Go

Small program tuning

Refs

Related Posts

RabbitMQ CentOS

Settle! Dockershim code will be officially removed in K8s V1.24

Mutexes solve atomic problems